Frank
bb0404c310
- compose: hermes-webui runs bootstrap.py --foreground in the agent image, shares /home/dank/hermes-data (same uid mapping as the gateway), publishes 127.0.0.1:8787 only; password from host .env - planner/remote deployer: hermes-webui is an isolated Dankclaw service - tests: deployment integrity seam (loopback, auth, volume, healthcheck, planner narrowing, deployer dispatch) - docs: Hermes-WebUI page with the iOS SSH-tunnel access pattern
42 lines
2.1 KiB
Markdown
42 lines
2.1 KiB
Markdown
# Hermes-Dashboard
|
|
|
|
The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See [[Hermes]].
|
|
|
|
**Host:** Dankclaw — **Port:** `9119` — **URL:** `http://192.168.0.143:9119`
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Image | `docker.io/nousresearch/hermes-agent:latest` (same as the gateway) |
|
|
| Command | `hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build` |
|
|
| Port | `9119` (published to the LAN) |
|
|
| Auth | HTTP basic auth (username + scrypt password hash) |
|
|
| Data | shares `/home/dank/hermes-data` with the gateway |
|
|
|
|
## Why a separate container
|
|
|
|
The gateway container runs `hermes gateway run` (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process. So it runs in its own compose service (`hermes-dashboard`). Both services mount the same data volume. Both restart at boot (`restart: unless-stopped`).
|
|
|
|
## Authentication
|
|
|
|
The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:
|
|
|
|
- `dashboard.basic_auth.username` and `dashboard.basic_auth.password_hash` live in the live `/home/dank/hermes-data/config.yaml`; the tracked backup at `dankclaw/hermes/config.yaml.example` intentionally omits the password hash.
|
|
- The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
|
|
- The hash is generated with `plugins.dashboard_auth.basic.hash_password`.
|
|
|
|
## Access
|
|
|
|
Open `http://192.168.0.143:9119` in a browser on the LAN. Log in with the configured username and password.
|
|
|
|
## Gotchas
|
|
|
|
- The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
|
|
- If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
|
|
- `--skip-build` uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.
|
|
|
|
## See Also
|
|
|
|
- [[Hermes-WebUI]] — the phone-facing API server (Hermex)
|